CrackerTracker Exploit False Positives

[geoff1]

One for altering the group de.scriptions:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forums/admin/admin_groups.php
----------------

Request-Method: POST

Matching rule: or
In variable: group_de.scription

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forums/admin/admin_groups.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('group_de.scription');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

[Helter]

this is what I have for admin_pa_catagory

Code: Select all

define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('addcategory','submit');

and for admin_groups

Code: Select all

define('CT_SECLEVEL', 'LOW');$ct_ignorepvar = array('new','group_name','group_de.scription','username');

[zenrei]

Thanks guys for the contributions, they really are helping out.

For PCP Wizard, try opening up admin/admin_pcp_wizard.php and replacing the MEDIUM with LOW. That may solve all issues with the wizard.

what medium??

I just went into the php in edit mode and there isn't anything that says MEDIUM

[CaNNon]

That was done in 2 parts, they added the medium then dropped it to low.
combined it should be like this.

Find ---> define('IN_PHPBB', 1);
Then add ---> define('CT_SECLEVEL', 'LOW');

[zenrei]

yeah... thanks <img> i didn't figure that out until later... i was having one of my dork moments

[Juppertje]

every whee is see here

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);



But i only have


define('IN_PHPBB', true);

so is this the same or have i also to replace define('IN_PHPBB', true); with define('IN_PHPBB', 1); ?

[CaNNon]

1 and true are the same, just add the line after it.

[Juppertje]

1 and true are the same, just add the line after it.

okay txs

[nGAGE]

Just wondering... with all these fixes being posted... WHY do these problems happen in the first place? Shouldn't there be a patch to fix what's necessary if it's such a common problem? or are these problems not applicable on every install?
I (to be honest) find it an extreme pain in my behind and it takes me more time to fix this crap-tracker then to design an entire theme. Please find a solution for this! If necessary, post a tutorial on uninstalling crap-tracker from IM... as I've only had useless problems with it constantly banning my members for no reason or blocking me from doing the most common/basic admin tasks! This only prevents me from managing my site properly and I've got other things to do as well then to check .scripts everytime a function fails to co-operate.

Don't get me wrong! I love IM and I intend on using it, but the crap-tracker is more of a pain in the behind then it does good to me.

[ZacFields]

ngage,

Not sure if you've tried my patch yet. There is a patch out there but it is very much a work-in-progress. I haven't updated it in a while but it solves the most basic problems with crackertracker. Mainly the admin-side stuff.

http://www.integramod.com/forum/viewtopic.php?t=2830

Zac

[nGAGE]

Thnx... Truly appreciate that link. Missed that post! I'll surely post if I encounter anymore problems <img>

[nGAGE]

ADDING ALLOWED HTML-Code

OPEN admin/admin_board.php

FIND

Code: Select all

 define('IN_PHPBB', 1);  

AFTER ADD

Code: Select all

 define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('allow_html_tags',);  

IF $ct_ignorepvar EXISTS]  $ct_ignorepvar = array('***');  [/php]

*** = Being any code existing already

INLINE, FIND

Code: Select all

 );  

INLINE, REPLACE

Code: Select all

 ,'allow_html_tags');  

[.QUACK.Major.Pain]

I checked that file and already in my file from my original install.
Think someone beat you to it .

I'm still waiting for a fix to use html in posts. Trying to use paypal Buy Now button but only offered in html.

[nGAGE]

Maybe I've overlooked it with the previous fixes posted here, but I've just been trying to make a collection of all of them on my own site as well, as I still have a theory about the patch mentioned somewhere that overwrites only the ctracker/engines/ct_security.php file to fix a lot of the CT issues.

It seems to me that it just adds all this stuff to be "Ignored" and I'm not sure that could have a "Global" effect and effect on the security itself! Fixing the individual files that actually cause problems seems a better bet to me, but ok... I'm not knowledgeable enough with php to make a proper statement!

Will try to find out more about that theory though and keep you all posted.

[nGAGE]

Could be that I've overlooked this one somewhere, but still... here we go:

Creating KnowledgeBase Types

OPEN /admin/admin_kb_types.php

FIND

Code: Select all

 if ( file_exists( './../viewtopic.php' ) ){     define( 'IN_PHPBB', 1 );     define( 'IN_PORTAL', 1 );     define( 'MXBB_MODULE', false );  

AFTER ADD

Code: Select all

 define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('create','edit','delete');  

IF $ct_ignorepvar EXISTS
FIND / INLINE, FIND

Code: Select all

 $ct_ignorepvar = array(  

INLINE, AFTER ADD

Code: Select all

 'create','edit','delete',  

PS]http://www.net-clan-gaming.com/viewforum.php?f=54[/url]

[TheJT]

i always get an allert in acp->Forum Admin->Management + -> Creat New Forum

sometimes when i try to write something under "De.scription" i get this allert

[nGAGE]

There is a fix for that already, but nobody really posted here anymore... so I don't have my bookmarks to the patch anymore ) It will have the fix though to solve your specifig issue and most of the common ones!
You may simply want to use the "Patch"-like edit, or do all the individual edits, either way... a lot of problems with CT will be solved. Personally I prefer editing the individual files, as I will then be assured that I only change something for that specific file and not globally, like the patch might do (not sure though).

Anyhow... have fun creating forums after this

[Michalis]

Hi guys.
Just wanted to say a few things. This integramod 1.4.1 is awsome. it has to be one of the best moded php i have come accross recently.
I have been a fan of & using in the past PHPBB2+. This Integramod 1.4.1 has opened my eyes & made my board more popular with its features in place.

I di have a few probs atm with the ct tracker on the board, I have searched on this forum for individual examples that effect me to & with no luck I did not find any help.

Also just to point out I have added the new ctracker patches & unfortunately my small problems are not fixed.

The problems I have are as follows.

1. Links SOLVED
I have added 2 links already to my board thru the ACP with no problem, but adding any more I get the dreaded pink box from the C Tracker. I really dont understand why this is causing me problems. (remember i have added the latest CT patch.).

1. Downloads SOLVED After making the catorgories for the Download section of the board I have come accross with another dreaded pink box when trying to ad info & files in file management.

Is there any individual fixes for the problems I have or can someone kindly help me resolve these issues. This has been bugging me for some time, I have been very patient in searching this forum for resolutions.

Thanx guys for reading this & hope someone maybe able to help.

Integramod definately rocks php

[Michalis]

Well I have to say the following:

I finally managed to read all the posts in this perticular section & must say that i finally got round to understanding some of the fixes that most of you sorted.

I must admin this section does actually work, especially if somke of the members who post in this section could actually put the title what the debug or fix is for.
But anyway I managed to go thru this section & payed attention to the problems that i faced too. I went out of my way & followed the instruction of the fixes I needed to do. I must say thanx to all in this section for you effort in reporting the debugs / fixes that we have with the cool CTracker. I actually managed to fix some of my board with the advice here.

Links
Banners
Downloads

I still have a few minor probs now which have not been answered or have popped up again with a fault.

one of them is to do with the index permissions
http://www.integramod.com/forum/viewtop ... highlight=

& unread messages
http://www.integramod.com/forum/viewtop ... highlight=

also some of my members cannot enter registration cause they get the pink box & when I add them thru the ACP & they try to enter the forum again to login the box appears again. so that one has confused me alot..

But besides all that I really do love this new php version (integramod) real quality. I also noticed in this section a few members were impatient.
This is a shame because the main members who do all of this & give helpful advise are not robots, but human being who do need rest on a few occasions. Plus these fixes cannot be known unless people tell. But take it in mind this integramod is free of charge & we should be thankful that it is shared to the public.

So guys lets be patient if there is no fix on the other section of this board then this section may have your answer if not then relax & wait .

Thanx again for all your help that u have provided me in some of the fixes/help I needed. very much obliged...

[Juppertje]

I have done what is mentiomet below and afther i edited the file i still get


SECURITY ALERT ÂÂ » ÂÂ » ÂÂ » ÂÂ »
CBACK CrackerTracker has detected a potential attack on this site with a worm or exploit .script so the Security System stopped the .script.


If you can see this page after including a new MOD into your board or after clicking on a link please contact the Board Administrator with this error message and a de.scription what you have done before you could see this page, that the Admin has the possibility to fix the problem.


So now what?

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forum/admin/admin_kb_cat.php
----------------

Request-Method: POST

Matching rule: rm
In variable: catname

Matching rule: rm
In variable: catname

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forum/admin/admin_kb_cat.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('catname');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forum/admin/admin_kb_cat.php
----------------

Request-Method: POST

Matching rule: rm
In variable: catname

Matching rule: rm
In variable: catname

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forum/admin/admin_kb_cat.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('catname');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Here is the full admin_kb_cat.php file

Code: Select all

<php>sql_query( $sql ) )     {         message_die( GENERAL_ERROR, "Couldn't get list of forums", "", __LINE__, __FILE__, $sql );     }       $forumlist = '<select>';       if ( $sel_id == 0 )     $forumlist .= '<option> Select a Forum !</option>';         while ( $row = $db->sql_fetchrow( $result ) )     {         if ( $sel_id == $row['forum_id'] )         {             $status = "selected";         }         else         {             $status = '';         }         $forumlist .= '<option>' . $row['forum_name'] . '</option>';     }       $forumlist .= '</select>';       return $forumlist;}    if ( isset( $HTTP_POST_VARS['mode'] ) || isset( $HTTP_GET_VARS['mode'] ) ){     $mode = ( isset( $HTTP_POST_VARS['mode'] ) ) ? $HTTP_POST_VARS['mode'] : $HTTP_GET_VARS['mode'];}else{     if ( $create )     {         $mode = 'create';     }     else if ( $edit )     {         $mode = 'edit';     }     else if ( $delete )     {         $mode = 'delete';     }     else     {         $mode = '';     }}  switch ( $mode ){     case ( 'create' ):           if ( !$HTTP_POST_VARS['submit'] )         {             $new_cat_name = stripslashes( $HTTP_POST_VARS['new_cat_name'] );                         // Generate page                         $template->set_filenames( array( 'body' => 'admin/kb_cat_edit_body.tpl' )                 );               $template->assign_block_vars( 'switch_cat', array() );               $template->assign_vars( array( 'L_EDIT_TITLE' => $lang['Create_cat'],                     'L_EDIT_DESCRIPTION' => $lang['Create_de.scription'],                     'L_CATEGORY' => $lang['Category'],                     'L_DESCRIPTION' => $lang['Article_de.scription'],                     'L_NUMBER_ARTICLES' => $lang['Articles'],                     'L_CAT_SETTINGS' => $lang['Cat_settings'],                     'L_CREATE' => $lang['Create'],                     'L_PARENT' => $lang['Parent'],                     'L_NONE' => $lang['None'],                       'PARENT_LIST' => get_kb_cat_list( '', 0, 1, 0, 0, true ),                       'L_FORUM_ID' => $lang['Forum_id'],                     'L_FORUM_ID_EXPLAIN' => $lang['Forum_id_explain'],                     'FORUM_LIST' => get_forums( ),                       'S_ACTION' => append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=create" ),                     'CAT_NAME' => $new_cat_name,                     'DESC' => '',                     'NUMBER_ARTICLES' => '0',                                         // Category permissions                     'L_CAT_PERMISSIONS' => $lang['Category_Permissions'],                     'L_VIEW_LEVEL' => $lang['View_level'],                     'L_UPLOAD_LEVEL' => $lang['Upload_level'],                     'L_RATE_LEVEL' => $lang['Rate_level'],                     'L_COMMENT_LEVEL' => $lang['Comment_level'],                     'L_EDIT_LEVEL' => $lang['Edit_level'],                     'L_DELETE_LEVEL' => $lang['Delete_level'],                     'L_APPROVAL_LEVEL' => $lang['Approval_level'],                     'L_APPROVAL_EDIT_LEVEL' => $lang['Approval_edit_level'],                     'L_GUEST' => $lang['Forum_ALL'],                     'L_REG' => $lang['Forum_REG'],                     'L_PRIVATE' => $lang['Forum_PRIVATE'],                     'L_MOD' => $lang['Forum_MOD'],                     'L_ADMIN' => $lang['Forum_ADMIN'],                                         'L_DISABLED' => $lang['Disabled'],                                       'VIEW_GUEST' => 'selected="selected"',                     'UPLOAD_REG' => 'selected="selected"',                     'RATE_REG' => 'selected="selected"',                     'COMMENT_REG' => 'selected="selected"',                     'EDIT_REG' => 'selected="selected"',                     'DELETE_MOD' => 'selected="selected"',                     'APPROVAL_DISABLED' => 'selected="selected"',                                         'S_GUEST' => AUTH_ALL,                     'S_USER' => AUTH_REG,                     'S_PRIVATE' => AUTH_ACL,                     'S_MOD' => AUTH_MOD,                     'S_ADMIN' => AUTH_ADMIN                      ) );         }         else if ( $HTTP_POST_VARS['submit'] )         {             $cat_name = trim( $HTTP_POST_VARS['catname'] );               if ( !$cat_name )             {                 echo "Please put a category name in!";             }               $cat_desc = $HTTP_POST_VARS['catdesc'];             $parent = intval( $HTTP_POST_VARS['parent'] );             $comments_forum_id = intval( $HTTP_POST_VARS['forum_id'] );                         if ( $comments_forum_id == 0 )             {                 mx_message_die(GENERAL_MESSAGE , 'Select a Forum');               }             $view_level = intval( $HTTP_POST_VARS['auth_view'] );             $post_level = intval( $HTTP_POST_VARS['auth_post'] );             $rate_level = intval( $HTTP_POST_VARS['auth_rate'] );             $comment_level = intval( $HTTP_POST_VARS['auth_comment'] );             $edit_level = intval( $HTTP_POST_VARS['auth_edit'] );             $delete_level = intval( $HTTP_POST_VARS['auth_delete'] );             $approval_level = intval( $HTTP_POST_VARS['auth_approval'] );             $approval_edit_level = intval( $HTTP_POST_VARS['auth_approval_edit'] );               $sql = "SELECT MAX(cat_order) AS cat_order             FROM " . KB_CATEGORIES_TABLE . " WHERE parent = $parent";             if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, 'Could not obtain next type id', '', __LINE__, __FILE__, $sql );             }               if ( !( $id = $db->sql_fetchrow( $result ) ) )             {                 mx_message_die( GENERAL_ERROR, 'Could not obtain next type id', '', __LINE__, __FILE__, $sql );             }             $cat_order = $id['cat_order'] + 10;               $sql = "INSERT INTO " . KB_CATEGORIES_TABLE . " ( category_name, category_details, number_articles, parent, cat_order, auth_view, auth_post, auth_rate, auth_comment, auth_edit, auth_delete, auth_approval, auth_approval_edit, comments_forum_id)" . " VALUES                                                             ( '$cat_name', ' $cat_desc', '0',                 '$parent', '$cat_order', '$view_level', '$post_level', '$rate_level', '$comment_level', '$edit_level', '$delete_level', '$approval_level', '$approval_edit_level', '$comments_forum_id')";               if ( !( $results = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not create category", '', __LINE__, __FILE__, $sql );             }               $message = $lang['Cat_created'] . '<br><br>' . sprintf( $lang['Click_return_cat_manager'], '<a>', '</a>' ) . '<br><br>' . sprintf( $lang['Click_return_admin_index'], '<a>', '</a>' );               message_die( GENERAL_MESSAGE, $message );         }         break;       case ( 'edit' ):           if ( !$HTTP_POST_VARS['submit'] )         {             $cat_id = intval( $HTTP_GET_VARS['cat'] );               $sql = "SELECT * FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = " . $cat_id;               if ( !( $results = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not obtain category information", '', __LINE__, __FILE__, $sql );             }             if ( $kb_cat = $db->sql_fetchrow( $results ) )             {                 $cat_name = $kb_cat['category_name'];                 $cat_desc = $kb_cat['category_details'];                 $number_articles = $kb_cat['number_articles'];                 $parent = $kb_cat['parent'];                 $comments_forum_id = $kb_cat['comments_forum_id'];             }                         // Generate page                         $template->set_filenames( array( 'body' => 'admin/kb_cat_edit_body.tpl' )                 );               $template->assign_block_vars( 'switch_cat', array() );             $template->assign_block_vars( 'switch_cat.switch_edit_category', array() );               $template->assign_vars( array( 'L_EDIT_TITLE' => $lang['Edit_cat'],                     'L_EDIT_DESCRIPTION' => $lang['Edit_de.scription'],                     'L_CATEGORY' => $lang['Category'],                     'L_DESCRIPTION' => $lang['Article_de.scription'],                     'L_NUMBER_ARTICLES' => $lang['Articles'],                     'L_CAT_SETTINGS' => $lang['Cat_settings'],                     'L_CREATE' => $lang['Edit'],                       'L_PARENT' => $lang['Parent'],                     'L_NONE' => $lang['None'],                       'PARENT_LIST' => get_kb_cat_list( '', $parent, $parent, true, 0, true ),                       'S_ACTION' => append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=edit" ),                     'CAT_NAME' => $cat_name,                     'CAT_DESCRIPTION' => $cat_desc,                     'NUMBER_ARTICLES' => $number_articles,                       'L_FORUM_ID' => $lang['Forum_id'],                     'L_FORUM_ID_EXPLAIN' => $lang['Forum_id_explain'],                     'FORUM_LIST' => get_forums( $comments_forum_id ),                                         // Cat permissions                     'L_CAT_PERMISSIONS' => $lang['Category_Permissions'],                     'L_VIEW_LEVEL' => $lang['View_level'],                     'L_UPLOAD_LEVEL' => $lang['Upload_level'],                     'L_RATE_LEVEL' => $lang['Rate_level'],                     'L_COMMENT_LEVEL' => $lang['Comment_level'],                     'L_EDIT_LEVEL' => $lang['Edit_level'],                     'L_DELETE_LEVEL' => $lang['Delete_level'],                     'L_APPROVAL_LEVEL' => $lang['Approval_level'],                     'L_APPROVAL_EDIT_LEVEL' => $lang['Approval_edit_level'],                     'L_GUEST' => $lang['Forum_ALL'],                     'L_REG' => $lang['Forum_REG'],                     'L_PRIVATE' => $lang['Forum_PRIVATE'],                     'L_MOD' => $lang['Forum_MOD'],                     'L_ADMIN' => $lang['Forum_ADMIN'],                                         'L_DISABLED' => $lang['Disabled'],                                         'VIEW_GUEST' => ( $kb_cat['auth_view'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'VIEW_REG' => ( $kb_cat['auth_view'] == AUTH_REG ) ? 'selected="selected"' : '',                     'VIEW_PRIVATE' => ( $kb_cat['auth_view'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'VIEW_MOD' => ( $kb_cat['auth_view'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'VIEW_ADMIN' => ( $kb_cat['auth_view'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'UPLOAD_GUEST' => ( $kb_cat['auth_post'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'UPLOAD_REG' => ( $kb_cat['auth_post'] == AUTH_REG ) ? 'selected="selected"' : '',                     'UPLOAD_PRIVATE' => ( $kb_cat['auth_post'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'UPLOAD_MOD' => ( $kb_cat['auth_post'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'UPLOAD_ADMIN' => ( $kb_cat['auth_post'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'RATE_GUEST' => ( $kb_cat['auth_rate'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'RATE_REG' => ( $kb_cat['auth_rate'] == AUTH_REG ) ? 'selected="selected"' : '',                     'RATE_PRIVATE' => ( $kb_cat['auth_rate'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'RATE_MOD' => ( $kb_cat['auth_rate'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'RATE_ADMIN' => ( $kb_cat['auth_rate'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'COMMENT_GUEST' => ( $kb_cat['auth_comment'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'COMMENT_REG' => ( $kb_cat['auth_comment'] == AUTH_REG ) ? 'selected="selected"' : '',                     'COMMENT_PRIVATE' => ( $kb_cat['auth_comment'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'COMMENT_MOD' => ( $kb_cat['auth_comment'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'COMMENT_ADMIN' => ( $kb_cat['auth_comment'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'EDIT_REG' => ( $kb_cat['auth_edit'] == AUTH_REG ) ? 'selected="selected"' : '',                     'EDIT_PRIVATE' => ( $kb_cat['auth_edit'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'EDIT_MOD' => ( $kb_cat['auth_edit'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'EDIT_ADMIN' => ( $kb_cat['auth_edit'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'DELETE_REG' => ( $kb_cat['auth_delete'] == AUTH_REG ) ? 'selected="selected"' : '',                     'DELETE_PRIVATE' => ( $kb_cat['auth_delete'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'DELETE_MOD' => ( $kb_cat['auth_delete'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'DELETE_ADMIN' => ( $kb_cat['auth_delete'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'APPROVAL_DISABLED' => ( $kb_cat['auth_approval'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'APPROVAL_MOD' => ( $kb_cat['auth_approval'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'APPROVAL_ADMIN' => ( $kb_cat['auth_approval'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                                             'APPROVAL_EDIT_DISABLED' => ( $kb_cat['auth_approval_edit'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'APPROVAL_EDIT_MOD' => ( $kb_cat['auth_approval_edit'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'APPROVAL_EDIT_ADMIN' => ( $kb_cat['auth_approval_edit'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                                     'S_GUEST' => AUTH_ALL,                     'S_USER' => AUTH_REG,                     'S_PRIVATE' => AUTH_ACL,                     'S_MOD' => AUTH_MOD,                     'S_ADMIN' => AUTH_ADMIN,                         'S_HIDDEN' => '<input>' )                 );         }         else if ( $HTTP_POST_VARS['submit'] )         {             $cat_id = intval( $HTTP_POST_VARS['catid'] );             $cat_name = trim( $HTTP_POST_VARS['catname'] );             $cat_desc = $HTTP_POST_VARS['catdesc'];             $number_articles = intval( $HTTP_POST_VARS['number_articles'] );             $parent = intval( $HTTP_POST_VARS['parent'] );             $comments_forum_id = intval( $HTTP_POST_VARS['forum_id'] );                         $view_level = intval( $HTTP_POST_VARS['auth_view'] );             $post_level = intval( $HTTP_POST_VARS['auth_post'] );             $rate_level = intval( $HTTP_POST_VARS['auth_rate'] );             $comment_level = intval( $HTTP_POST_VARS['auth_comment'] );             $edit_level = intval( $HTTP_POST_VARS['auth_edit'] );             $delete_level = intval( $HTTP_POST_VARS['auth_delete'] );             $approval_level = intval( $HTTP_POST_VARS['auth_approval'] );             $approval_edit_level = intval( $HTTP_POST_VARS['auth_approval_edit'] );                 if ( !$cat_name )             {                 echo "Please put a category name in!";             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET category_name = '" . $cat_name . "', category_details = '" . $cat_desc . "', number_articles = '" . $number_articles . "', parent = '" . $parent . "', auth_view = '" . $view_level . "', auth_post = '" . $post_level . "', auth_rate = '" . $rate_level . "', auth_comment = '" . $comment_level . "', auth_edit = '" . $edit_level . "', auth_delete = '" . $delete_level . "', auth_approval = '" . $approval_level . "', auth_approval_edit = '" . $approval_edit_level . "', comments_forum_id = '" . $comments_forum_id . "' WHERE category_id = " . $cat_id;               if ( !( $results = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update category", '', __LINE__, __FILE__, $sql );             }               $message = $lang['Cat_edited'] . '<br><br>' . sprintf( $lang['Click_return_cat_manager'], '<a>', '</a>' ) . '<br><br>' . sprintf( $lang['Click_return_admin_index'], '<a>', '</a>' );               mx_message_die( GENERAL_MESSAGE, $message );         }         break;       case ( 'delete' ):           if ( !$HTTP_POST_VARS['submit'] )         {             $cat_id = $HTTP_GET_VARS['cat'];               $sql = "SELECT *                 FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = '" . $cat_id . "'";               if ( !( $cat_result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not obtain category information", '', __LINE__, __FILE__, $sql );             }               if ( $category = $db->sql_fetchrow( $cat_result ) )             {                 $cat_name = $category['category_name'];             }                         // Generate page                         $template->set_filenames( array( 'body' => 'admin/kb_cat_del_body.tpl' )                 );               $template->assign_vars( array( 'L_DELETE_TITLE' => $lang['Cat_delete_title'],                     'L_DELETE_DESCRIPTION' => $lang['Cat_delete_desc'],                     'L_CAT_DELETE' => $lang['Cat_delete_title'],                     'L_DELETE_ARTICLES' => $lang['Delete_all_articles'],                       'L_CAT_NAME' => $lang['Article_category'],                     'L_MOVE_CONTENTS' => $lang['Move_contents'],                     'L_DELETE' => $lang['Move_and_Delete'],                       'S_HIDDEN_FIELDS' => '<input>',                     'S_SELECT_TO' => get_kb_cat_list( '', $cat_id, 0, true, 0, true ),                     'S_ACTION' => append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=delete" ),                       'CAT_NAME' => $cat_name )                 );         }         else if ( $HTTP_POST_VARS['submit'] )         {             $new_category = $HTTP_POST_VARS['move_id'];             $old_category = $HTTP_POST_VARS['catid'];               if ( $new_category != '0' )             {                 $sql = "UPDATE " . KB_ARTICLES_TABLE . " SET article_category_id = '$new_category'                WHERE article_category_id = '$old_category'";                   if ( !( $move_result = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not move articles", '', __LINE__, __FILE__, $sql );                 }                   $sql = "SELECT *                    FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = '$new_category'";                   if ( !( $cat_result = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not get category data", '', __LINE__, __FILE__, $sql );                 }                   if ( $new_cat = $db->sql_fetchrow( $cat_result ) )                 {                     $new_articles = $new_cat['number_articles'];                 }                   $sql = "SELECT *                    FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = '$old_category'";                   if ( !( $oldcat_result = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not get category data", '', __LINE__, __FILE__, $sql );                 }                   if ( $old_cat = $db->sql_fetchrow( $oldcat_result ) )                 {                     $old_articles = $old_cat['number_articles'];                 }                   $number_articles = $new_articles + $old_articles;                   $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET number_articles = '" . $number_articles . "' WHERE category_id = " . $new_category;                   if ( !( $number_result = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not update articles number", '', __LINE__, __FILE__, $sql );                 }             }             else             {                 $sql = "DELETE FROM " . KB_ARTICLES_TABLE . "                         WHERE article_category_id = " . $old_category;                 if ( !( $delete__articles = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not delete articles", '', __LINE__, __FILE__, $sql );                 }             }               $sql = "DELETE FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = $old_category";               if ( !( $delete_result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not delete category", '', __LINE__, __FILE__, $sql );             }               $message = $lang['Cat_deleted'] . '<br><br>' . sprintf( $lang['Click_return_cat_manager'], '<a>', '</a>' ) . '<br><br>' . sprintf( $lang['Click_return_admin_index'], '<a>', '</a>' );               mx_message_die( GENERAL_MESSAGE, $message );         }         break;       default:           if ( $mode == "up" )         {             $cat_id = $HTTP_GET_VARS['cat'];               $sql = "SELECT *              FROM " . KB_CATEGORIES_TABLE . "            WHERE category_id = $cat_id";               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not get category data", '', __LINE__, __FILE__, $sql );             }               if ( $category = $db->sql_fetchrow( $result ) )             {                 $parent = $category['parent'];                 $old_pos = $category['cat_order'];                 $new_pos = $old_pos-10;             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET            cat_order = '" . $old_pos . "'            WHERE parent = " . $parent . " AND cat_order = " . $new_pos;               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update order", '', __LINE__, __FILE__, $sql );             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET            cat_order = '" . $new_pos . "'            WHERE category_id = " . $cat_id;               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update order", '', __LINE__, __FILE__, $sql );             }         }           if ( $mode == "down" )         {             $cat_id = $HTTP_GET_VARS['cat'];               $sql = "SELECT *              FROM " . KB_CATEGORIES_TABLE . "            WHERE category_id = $cat_id";               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not get category data", '', __LINE__, __FILE__, $sql );             }               if ( $category = $db->sql_fetchrow( $result ) )             {                 $parent = $category['parent'];                 $old_pos = $category['cat_order'];                 $new_pos = $old_pos + 10;             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET            cat_order = '" . $old_pos . "'            WHERE parent = " . $parent . " AND cat_order = " . $new_pos;               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update order", '', __LINE__, __FILE__, $sql );             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET            cat_order = '" . $new_pos . "'            WHERE category_id = " . $cat_id;               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update order", '', __LINE__, __FILE__, $sql );             }         }                 // Generate page                 $template->set_filenames( array( 'body' => 'admin/kb_cat_admin_body.tpl' )             );           $template->assign_vars( array( 'L_KB_CAT_TITLE' => $lang['Cat_man'],                 'L_KB_CAT_DESCRIPTION' => $lang['KB_cat_de.scription'],                   'L_CREATE_CAT' => $lang['Create_cat'],                 'L_CREATE' => $lang['Create'],                 'L_CATEGORY' => $lang['Article_category'],                 'L_ACTION' => $lang['Art_action'],                 'L_ARTICLES' => $lang['Articles'],                 'L_ORDER' => $lang['Update_order'],                   'S_ACTION' => append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=create" ) )             );         // get categories         $sql = "SELECT *                 FROM " . KB_CATEGORIES_TABLE . "             WHERE parent = 0 ORDER BY cat_order ASC";           if ( !( $cat_result = $db->sql_query( $sql ) ) )         {             mx_message_die( GENERAL_ERROR, "Could not obtain category information", '', __LINE__, __FILE__, $sql );         }           $ss = 0;         while ( $category = $db->sql_fetchrow( $cat_result ) )         {             $category_details = $category['category_details'];             $category_articles = $category['number_articles'];               $category_id = $category['category_id'];             $category_name = $category['category_name'];             $temp_url = append_sid( $module_root_path . "kb.$phpEx?mode=cat&cat=$category_id" );             $category_link = '<a>' . $category_name . '</a>';               $temp_url = append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=edit&cat=$category_id" );             $edit = '<a><img></a>';               $temp_url = append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=delete&cat=$category_id" );             $delete = '<a><img></a>';               $temp_url = append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=up&cat=$category_id" );             $up = '<a>' . $lang['Move_up'] . '</a>';               $temp_url = append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=down&cat=$category_id" );             $down = '<a>' . $lang['Move_down'] . '</a>';               $row_color = ( !( $ss % 2 ) ) ? $theme['td_color1'] : $theme['td_color2'];             $row_class = ( !( $ss % 2 ) ) ? $theme['td_class1'] : $theme['td_class2'];               $template->assign_block_vars( 'catrow', array( 'CATEGORY' => $category_link,                     'CAT_DESCRIPTION' => $category_details,                     'CAT_ARTICLES' => $category_articles,                       'U_EDIT' => $edit,                     'U_DELETE' => $delete,                     'U_UP' => $up,                     'U_DOWN' => $down,                       'ROW_COLOR' => '#' . $row_color,                     'ROW_CLASS' => $row_class )                 );               $i++;             $ss++;             $ss = get_kb_cat_subs_admin( $category_id, '1', '    ', $ss );         }         break;}  $template->pparse( 'body' );include_once( $mx_root_path . 'admin/page_footer_admin.' . $phpEx );  ?>

[Master Dwarf]

For Merging Topics

#
#-----[ OPEN ]------------------------------------------
#
/yourportalroot/merge.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', True);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('topic_title');

[jomasaco]

And for the global news on Crack Tracker.
when i try to put a msg always gives me that stupid error, and i canÂÂ ´t pass this out.
what is the fix?

[salmercker]

ok deos anyone have the fix for the album_cat ? i did what ctracker told me and im still getting that error. everytime i try to create a new catagory. im about to just say screw it and do a work around by renaming the folder lol

also not sure if this is conserning ctracker or not but also get this error after i try to view a photo uploaded.

Fatal error: Cannot redeclare acronym_pass() (previously declared in /home/dragosia/public_html/album_mod/album_bbcode.php:3597) in /home/dragosia/public_html/includes/bbcode.php on line 1422

[CaNNon]

I didn't need any for that file, could you post your debug info?

[ThePlague]

Trying to set avtars to display as always because non members cannot see them.
PCP Wizzard >> Alter Page Display >> user_avatar


Debug Info:

Code: Select all

   ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename]------------------------------------------#/admin/admin_pcp_wizard.php  ##-----[ FIND ]------------------------------------------#require('./pagestart.' . $phpEx);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('style_user_rank_title','style_user_warnings');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM    

Debug Does Not Work. Anyone Have A Fix?

[CaNNon]

try this one.

Code: Select all

define('CT_SECLEVEL', 'LOW');$ct_ignorepvar = array('style_username','style_user_online','style_user_avatar','style_user_from','style_user_regdate','style_user_gender','style_user_age','style_user_posts','style_user_cashpr','style_user_cashtp','style_user_holidays','style_user_country','style_user_warnings','style_user_sig','style_user_photo','style_user_birthday','style_user_pm','style_user_album','style_user_email','style_user_website','style_user_aim','style_user_yim','style_user_msnm','style_user_skype','style_user_icq','style_user_rank_title','style_user_session_time','style_user_session_page','style_user_my_friend','style_user_my_ignore','style_user_posts_stat');

[ThePlague]

Thanks CaNNon

I Tried it but it's still refusing to let me change the display avatar option.

Think I might do what others have done.. Remove CT.
Not much point using it when all I have seen and read that it does is block out legitmate changes.

I am aware that its buggy, but for all the hasle it causes to admins it defeats the object of running it. Will wait for the bugs to be patched once and for all I think.

I have lots of CT messages appearing when I am trying to perform legal opporations within my ACP too many to sit and debug everytime lol.

Integramod itself works great, just what I needed for my clan site but CT is making setting it up a nightmare.

No offence to CT but its not for me yet.

Reminds me of the gaming anti cheat software punkbuster. We run it on our call of duty 2 multiplayer gaming server and all I have seen it remove is legitmate players including me lol

[CaNNon]

ROFLMFAO!
Yea good pick on that one, I know punkbuster all to well!
errrr.... do we know each other?

Try this first some others have used it to work around CT and well it worked for them. Rename the CT folder now your going to see a lot of errors at the top of each page but it's going to run make your fix's and then restore the folder name.

That ct progie is a lot of troubles to get running with all the things in this mod but trust me when your looking over the hack attempts in the log you'll be glad you have it. <img>

[ThePlague]

Hehehehe..

Funny but your name does look familiar

1.4.1 has proved really usefull... I spent 2 hours when I first installed it looking for a package manager to install mods with, then I realised that was the SMF forum system with a package manager ROFL!

Cheers CaNNon!

[CaNNon]

Happy hunting m8!

[varagon]

When changing or adding banners I get this problem.

It's a new install, so I might have more problems.

Where is this "patch" for all the problems on cbtracker at?

Thanks!

[CaNNon]

The latest down load has the patches included. On a new install you will need to debug. Follow the directions in the first post, then post the logged info if you need a hand.

[varagon]

Hi again. I changed the admin banner file as described in the logmanager debug entry, posted below, but still get the same pink debug window.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /admin/admin_banner.php
----------------

Request-Method: POST

Matching rule: or
In variable: banner_de.scription
In variable: banner_comment

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_banner.php

#
#-----[ FIND ]------------------------------------------
#
require('./pagestart.' . $phpEx);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('banner_de.scription','banner_comment');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Any more suggestsion?

I didn't quite understand the last page (3) of the linked post on debugging the files... quoted here:
http://www.integramod.com/forum/kb.php? ... =3&start=0

After changing the relevant file, change the Debug Mode in the ctracker/engines/ct_security.php from "true" to "false", so that there's no message in the header anymore.

If a php file requires "define('CT_SECLEVEL','MEDIUM');" code to be inserted in a file that has already been edited with CrackerTracker code, then you may need to edit the insert as follows:

This is how NOT to do it: (this is only an example)

define('CT_SECLEVEL','MEDIUM');
$ct_ignorepvar = array('message')
define('CT_SECLEVEL','MEDIUM');
$ct_ignorepvar = array('welcome_text')

This code would be correct:

define('CT_SECLEVEL','MEDIUM');
$ct_ignorepvar = array('message','welcome_text')

Happy Christmas, eh? <img>

Thanks a lot, again!

[CaNNon]

Code: Select all

define('CT_SECLEVEL', 'LOW');$ct_ignorepvar = array('banner_de.scription','banner_comment');

You can try this but I've never had to us a fix on that file, give it a bit though some one may have a answer.

The part your not understanding is syntax examples of proper and improper formating of the command and some examples. It's handy to understand that when you have to apply more that one fix to the same file.

[DjPorkchop]

So here is the million dollar question..... What do we do when we have done all the debugs that CTracker tells us too and no matter what we do, it STILL tells us to kiss it's A**?

Love having CTracker, but dam. lol Even it dont know all the answers but blocks them everything anyhow.

And I would say what it is doing it on, but there is so many things. Arcade, Classified ads, etc etc etc etc. Most of all Alerts that came up have been debugged but there are still some as I stated that no fix is to be had no matter what. This kind of shafts us out of creating a website to suit our needs if we have to do without and just go with a palin jane install. BORING!!!!! <img>

If anyone IS interested, it is as stated the activity mod on certain games And adding categories in classified ads mod.

[CaNNon]

I don't have stuff installed did you save the debug log?

[DjPorkchop]

Yeah....as a matter of fact I do have.

This one worked for classified ads

Code: Select all

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename]------------------------------------------#/ads_create.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('submit','additional_info');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM

Now I can create ads

This debug did not work

Code: Select all

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename]------------------------------------------#/admin/admin_ads_categories.php  ##-----[ FIND ]------------------------------------------#require('./pagestart.' . $phpEx);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('submit','category');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM

So now I can create ads and I have got to create SOME categories and sub categories. But others I try to create, it just wont let me.

*Edit*
Ok just for sh*ts and giggles, The category I was Creating was Merchandise For Sale I couldnt help but notice in the debug, the word OR So I changed the word For to Fer and Ctracker did NOT go off and I was able to create the category. <img> BUT I created another category with the word memorials and Cracker Tracker was never set off. Now Im scratching my Chin

[CaNNon]

Have to set it to LOW yet? That could help with stuff inside the fields.

[DjPorkchop]

Yep. I tried Low as well. I finally just ended up renaming the ctracker folder to -ctracker and set my ads up and adjusted some more stuff while I was at it.

Too bad i had to cheat the system, but had to get things in order. Im still playing with it though trying to find a fix.

[CaNNon]

Cheating the system no way, you just did a creative repair! <img>

[DjPorkchop]

[quote=""CaNNon";p="30557""]Cheating the system no way, you just did a creative repair! For sure. I still have some more to go though that I cant do a "creative repair" on. Like some of the games going off in cracker tracker for activity mod.

[DjPorkchop]

And the following debug info worked for the Vault Mod

Code: Select all

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename]------------------------------------------#/admin/admin_qbar.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('explain');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename: /admin/admin_vault_exchange.php----------------  Request-Method: POST  Matching rule: 'In variable:   stock_desc  Possible solution:------------------  ##-----[ OPEN ]------------------------------------------#/admin/admin_vault_exchange.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('stock_desc');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  

[spaniel]

Code: Select all

##-----[ OPEN ]------------------------------------------#/forums/kb.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('article_desc','message');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  

False positive.. applying this fix doesn't get rid of it. Error is when trying to add a KB article.

Can I ask, did you try setting the CT_SECLEVEL to 'LOW' instead of 'MEDIUM' and did it solve the problem?

Strange thing is, KB lets me post articles but one of my users said he got locked out by Ctracker when he tried.

[meijin]

In trying to add a new acronym to the list, I got a false positive....corrected with the following:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /im4/admin/admin_acronyms.php
----------------

Request-Method: POST

Matching rule: or
In variable: de.scription

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/im4/admin/admin_acronyms.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('de.scription');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Followed the referenced KB article and it worked like a charm.

I hope I posted this correctly and that it helps someone out.

Michael

[CaNNon]

I think we have a new record! Whats it like 12 hours from almost giving up to his first bit of helping others.

NICE! <img>

[meijin]

I think we have a new record! Whats it like 12 hours from almost giving up to his first bit of helping others.

NICE! <img>

LOL! With the great amount of help and support that I have gotten here, I just wanted to try and help out a little as well...that's what it is all about, right?

Thanks for the comments...

[CaNNon]

yep, was the same for me <img>

[BlahBlahCha]

Everytime i try to add a new Forum or category, that pops up and it says that it blocked a worm and so on, What's wrong? Hope you can help.

[CaNNon]

Check the first post in this tread get debug running and make the edit it says. if you still have a issue post the debug info so people can compare it to what they have done.

[BlahBlahCha]

Well, i changed it from false to true, but when i went back to my forum, i wasn't in debug mode. So i guess nothing happened, this message only appears when i'm editing a forum or creating one, it's odd.

[CaNNon]

You should have seen a CT block warning that it was in debug mode?

Also you may have to ftp into the CT folder and download the log.

[BlahBlahCha]

Well, i just opened my file manager and edited the code from false to true and saved it. Do i have to delete it and re-upload a new one? would that make a difference?

[CaNNon]

Aaaaa ....
You know after you save it you have to ftp it to the proper folder on your site? <img>

[BlahBlahCha]

Well, i edited it with phpmyadmin or whatever, and i "saved changes" So i didn't move it anywhere.

[Blue-Blood]

How do you debug?

What is it, a .script that will tell you how to fix your error problems?

[BlahBlahCha]

just rename the "ctracker" folder to anything, even if you just change one letter, then edit it, and then change the name back to normal. Be sure to be in your boards administrative panel before you rename it, worked for me <img>

[CaNNon]

It's better to do the edits as your kind of teaching it what you want it to do.

http://www.integramod.com/forum/kb.php? ... ticle&k=22
that will teach you how, one exception the newer versions of CT you have to get the log FTP from the folder.
Once you have a file name you just edit it and do the fix debug suggests.
If the debug doesn't work you come back to this tread and post the debug, it has enough info that
we can match it to ours and give you what edits we have done.

[Allen]

Umm I just found version 1.4.1g updated yesterday may 8th??? I downloaded version f april 23rd 2 weeks ago. and 2 weeks I spent debuging...

I am using 1.4.1f

Then I find version g just now.

First question, how do I upgrade from ver f to ver g? My admin window says I am up to date. Do I have to do a fresh install to get the new version?? All I can find is the full version and from 1.4.0-1.4.1 I need the one for 1.4.1f - 1.4.1g

[CaNNon]

I would do the new edits and not re install the full package. Helter posted the differences here: http://www.integramod.com/forum/integra ... t4940.html

[Allen]

So, you are telling me there is still no fix? This CTracker has been flawed for 1 1/2 years.. at least that is when this topic began...

Is there ever going to be a fix?

I am getting frustrated and honestly I dont think I can bring myself to edit this anymore.

I am starting to actually consider spending $160.00 and starting over with the "other" program.

[CaNNon]

I don't think your understanding the why Allen, CT is not broken or in need of a fix in the way you see it. As you know the package includes over 100 mods and CT can help protect whatever you wish to add if your willing to teach it. This is what makes it so good and yea I agree this can really be a pain sometimes.

[Allen]

your right, i am missing the why.. I would think that CT would already understand that PM's are allowed.. I just got a report of PM having CT warning. Real name in reg has CT warning. Couldn't the bulk of known OK action be patched or OK'd by CT before release?

[Allen]

really i am not trying to be difficult <img>

[CaNNon]

Do you have a debug for that? cause if you have the error I can compare it to my file and get you what I've done.

There are just to many files to guess, the package has like 10,000 small files when you include the bb2 and stuff I have on my site. If you don't have a debug turn it on and recreate what happened. We can help you but we do need a error so we know what were working on. <img>

[Allen]

So far I have added this to profile.php

define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('user_realname','helpbox','phpBBSecurity_question');
include($phpbb_root_path . 'common.'.$phpEx);

Seems to have taken care of realname, PM(helpbox) and SecurityQuestion.

I asume I will eventually have to add all the user fields required for login in the profile.php as Ok ..

First user reported trouble registering so I had to add 'user_realname' then they could register.
I just had to add the 'phpBBSecurity_question' for a second user that can't finish registering..

Stop the Insanity!

[CaNNon]

define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('helpbox','delete','deleteall','phpBBSecurity_question','user_interests');

This is what I have for that file. I never needed 'user_realname' you had that returned in a debug?

[Allen]

Yes I got real name in a Cracker Log when a friend was trying to register. Now today I get a report of an error on the profile page where you set occupation. I do not see that in your .script either. here is the debug file,,, Makes no cents.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /profile.php
----------------

Attack-Time: 11.05.2008 7:20 am
------------

Request-Method: POST

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/profile.php

#
#-----[ FIND ]------------------------------------------
#
include($phpbb_root_path . 'common.'.$phpEx);

#
#-----[ BEFORE, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

[CaNNon]

I don't have that var, I would guess something like "user_occupation" but hang on a bit someone may know/have it.

I've tried to keep all the posted vars edits, so I would have a kind of help record for them. So thanks for the one you've added. <img>

[BlahBlahCha]

I found a way to bypass the error that appears when doing certain things, Making forums, editing them, and sometimes pm's

Go to ACP/Security/Special
Once there, look under this message:

Warning: Setting any of the below to 'Ignore' will allow anyone to use these tricks on your site. You have been warned

And switch these two options to "Ignore"

1. Action to take in an SQL Injection attempt?
2. Action to take in a Sanity Mix Worm attempt?

I Strongly recommend that you switch them back to "ban" once you are done with what you wanted to do.

Works like a breeze <img>

[CaNNon]

BlahBlahCha, Thats not CrackerTracker thats phpBB Security and is a separate system.

I have no idea how or even if, that could help you in any way with CT debugging.

[BlahBlahCha]

I was surprised also, because i knew that it had nothing to do with Ctracker. unless it bypasses ctracker some how, they could be working together. It works everytime i turn those options off.

[CaNNon]

No bypass nor do they work together.
Maybe they matched a check both run at the same time on the same file?
In those cases debug should suggest the proper fix though.

[BlahBlahCha]

I'm not sure if that's possible, but you never know.
If this works, i have no reason to debug <img>
Plus whenever i try to enter debug mode, it never works.

[Allen]

My apologies if this issue has already been covered in this forum.

I recently had an issue with the send function of Chatspot. When I view the debug log the line it asks me to look for is not there,,,

Here is the debug log.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /chatspot/message_interpreter.php
----------------

Attack-Time: 12.05.2008 20:54 pm
------------

Request-Method: POST

Matching rule: or
In variable: sent

Matching rule: and
In variable: sent

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/chatspot/message_interpreter.php

#
#-----[ FIND ]------------------------------------------
#
include($phpbb_root_path . 'common.'.$phpEx);

#
#-----[ BEFORE, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('sent');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

After using the integramod search forums, I found this.

Omni-Lee
Offline
Joined: 31 Jan 2007
Total posts: 64
2469 Points
Donate

USA

PostPosted: 03 Feb 2007 11:09 pm Post subject: Re: Chatspot not functioning properly Reply with quoteBack to top
This is a problem with CrackTracker catching the 'sent'.

Look for:
PHP: à¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€šÃ‚ º à¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€šÃ‚ ¹ Select à¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€šÃ‚ ºÃƒÆ’ ¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€šÃ‚ ¹ Expand à¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€šÃ‚ º
define( 'IN_PHPBB', true );


Then insert below:
PHP: à¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€šÃ‚ º à¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€šÃ‚ ¹ Select à¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€šÃ‚ ºÃƒÆ’ ¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€šÃ‚ ¹ Expand à¢Ãƒ ¢Ã¢â‚¬Å¡Ã‚ ¬Ãƒâ€šÃ‚ º
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('sent');


That should fix you up. But before you do so, turn on CrackTracker debug and hop into chat. Use chat for a few minutes even if it doesn't work. View the CrackTracker debug logfile, to verify the issue was with 'sent'. Sorry I can't show my log, but I clear that log for my own debugging purposes periodically.

Any ideas on why the cracker tracker is asking me to find what is not there? Is there a different way I should understand the tracker? Also, is Omni-lee's answer the best answer?

[DjPorkchop]

Well fellas, I would NOT turn those 2 items off in phpBB security. Further more, yes cracker tracker is a pain in the ass. We all know that.

BUT do we all remember someone reporting a hacked site two and 3 times a day when Integramod was 1.4.0 with ONLY phpBB security? And I dont think caughing up the $$$ for the "Other SCript" is going to solve anything at all. I find the support on those sites shady at best. Pay for this, pay for that, pay pay pay pay. And nothing in return when you have issues. Integramod has dam good support for being....FREE.

I have cussed and screamed and hollered at CTracker until I was blue in the face but none the less, None of the 1.4.1 sites I have put up yet have been hacked. PhpBB , VB, IVPB, all of them are php and subject to hacking. One isnt any better then the other.

In the end, doing the debug is well worth it. Never ever take a site live until you debug. As stated before, you just need to teach it right from wrong. Though I do side with you that certain things should be exempt right off the get go such as registration info and stuff like that. That being said, I cant even help out with that area. Out of the DOZENS of IM 1.4.1 sites that I have put together for myself and others, have I ever got any CTracker errors on registration. I truly wish I could help but that I am just lost on.

Keep plugging away at it and before long it will be good to go.

[Allen]

This morning I found a debug in the viewtopic.php

Attack-Time: 14.05.2008 8:49 am
------------

Request-Method: GET

Matching rule: php_
In variable: a

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/viewtopic.php

#
#-----[ FIND ]------------------------------------------
#
include($phpbb_root_path . 'common.'.$phpEx);

#
#-----[ BEFORE, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('a');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Can someone provide me with a complete string for the viewtopic.php page.

Here is what I have so far.

define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('highlight','a');

I think I saw a post that someone had a webpage with all their ctracker patches, but I forgot and didnt save the page. I think it was cannon who posted it. Can I get the list?

[CaNNon]

I'd like to but i don't have any in viewtopic.php, I've never had CT go off on that one either.

[Allen]

I have found that CT does not go off on the first second maybe even third time using a function. But once you hit 3-4 it can go off.

[DjPorkchop]

I will let everyone know, One day before I was messing around trying to setoff CTracker on purpose and I noticed everytime I used any word that contained the letters O and R in consecutive order, CTracker would go off.

For example the words

For
Or
word
hord

Catch my drift? <img> Look for that when giving downloads, KB Articles and forums any de.scription or title with those tow letters in it. It almost will allways certainly set off CTracker.

[Allen]

I just got this and I am not sure of it. Is this an actuall attack or should I correct this .script in the files??

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /index.php
----------------

Attack-Time: 15.05.2008 12:12 pm
------------

Request-Method: GET

Matching rule: cmd
In variable: phpbb

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/index.php

#
#-----[ FIND ]------------------------------------------
#
include($phpbb_root_path . 'common.'.$phpEx);

#
#-----[ BEFORE, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('phpbb');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

[CaNNon]

usualy its in the logs trough ACP > CrackerTracker > Logmanager > Worm & Exploit Protection > View.

IF you could match the time and date to the log entries, I think you should find something like when not in debug mode! "/phpBB2/index.php?phpbb=<real>/~beogor/news/cmd??"

If your leaving that on just looking for debugs, be real care full what you debug you could easily allow a .script. <img>

*EDIT*
Sorry worded it better!

[Allen]

This is why I have asked here. I do not have any log of attack in the ACP > CrackerTracker > Logmanager > Worm & Exploit Protection > View.

Just the debug entry. Yes I am still debugging and debug is on. I do not want to allow a .script attack by adding the ignore .script so I came here and asked if what this is...

Let me know please I am waiting to do anything until I know from you.

[CaNNon]

Don't add it. It's in the debug log and not the attack log when its in debug mode.

[unknown25]

i have an error....but i cant fix it

Marquee up: [marq=up]++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forum/admin/admin_forums_extend.php
----------------

Attack-Time: 26.07.2008 12:41 pm
------------

Request-Method: POST

Matching rule: ls
In variable: desc

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forum/admin/admin_forums_extend.php

#
#-----[ FIND ]------------------------------------------
#
include($phpbb_root_path . 'common.'.$phpEx);

#
#-----[ BEFORE, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('desc');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forum/admin/admin_forums_extend.php
----------------

Attack-Time: 26.07.2008 13:13 pm
------------

Request-Method: POST

Matching rule: ls
In variable: desc

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forum/admin/admin_forums_extend.php

#
#-----[ FIND ]------------------------------------------
#
include($phpbb_root_path . 'common.'.$phpEx);

#
#-----[ BEFORE, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('desc');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

/marq]



i cant find the line:include($phpbb_root_path . 'common.'.$phpEx);

i searched the whole thing...pls help fast

[JohnYD]

unknown25: I dont have quite the same problem, but it came up with similar results and could not find the line specified.

I decided to add the information just below require($phpbb_root_path . 'extension.inc'); and it worked just fine for me.

This is what my few lines look like:

Code: Select all

//// Load default header//$phpbb_root_path = "./../";require($phpbb_root_path . 'extension.inc');define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('desc','create','delete','name','icon');require('./pagestart.' . $phpEx);include($phpbb_root_path . 'includes/functions_admin.'.$phpEx);  include_once($phpbb_root_path . 'includes/lite.'.$phpEx);$options = array(     'cacheDir' => $phpbb_root_path . 'var_cache/',);  

[zuerston]

Also, now I can't even change those settings at all. [Avatar/Sig, ect.]. I'm tempted to just uninstall ctracker until something is made to work. <img>

How do you uninstall this trash program anyway?? its really a sorry ass joke "ctracker"

[AliasWeird]

Where is this Knowledge Base showing me how to fix these false messages. As far as I can tell, there are no KB on this site.. I can't add/edit Categories to the forum.

[xero419]

Where is this Knowledge Base showing me how to fix these false messages. As far as I can tell, there are no KB on this site.. I can't add/edit Categories to the forum.

Agreed. I'm trying to put my CTmod in debug mode. I've done it before, but I forgot how.. it's not in the KB

[Allen]

I am having a tough time with the search function also. Since the new portal it has not been the same. It seems to ignore the smaller word when I am searching for a specific statement. I get results for just the larger word it seems. I am sure the box "Search for all terms or use query as entered" is checked.

[pangor]

Is there a comprehensive patch pack for all known failings of the poorly tested cracker tracker integration. Even with sites that have been running for years now, honest site members are being visited by that dreaded message effectively calling them criminals. Why has there been no such upgrade to say 1.4.2 been released with all such fixes already installed?

[viragotech]

error

[Karl-D]

Can somebody remind me how to activate the debug mode.

[CaNNon]

Try this KB post, if you still need help post back. <img>
[url=http]http://www.integramod.com/forum/knowledge/kb_show.php?id=12[/url]

[viragotech]

canot find said line in said file, CT error when trying to optmize DB

"include($phpbb_root_path . 'common.'.$phpEx);"


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /xxx/admin/admin_db_utilities.php
----------------

Attack-Time: 15.09.2010 23:47 pm
------------

Request-Method: POST

Matching rule: _server
In variable: selected_tbl

Matching rule: _server
In variable: selected_tbl

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/xxx/admin/admin_db_utilities.php

#
#-----[ FIND ]------------------------------------------
#
include($phpbb_root_path . 'common.'.$phpEx);

#
#-----[ BEFORE, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('selected_tbl');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Typical fix works,

#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('this_query');

#
#-----[ SAVE/CLOSE ALL FILES ]----------------------------------------- -
#
# EoM

[Helter]

FIND

Code: Select all

define('IN_PHPBB', 1);

AFTER, ADD

Code: Select all

define('CT_SECLEVEL', 'LOW');$ct_ignorepvar = array('selected_tbl');

[viragotech]

Yep the old goto code strikes again <img>

Any tips for random folks getting CT blocked doing the required profile updates, yet some are fine. Age of account seems to make no matter.

I had no problem.

[Helter]

you should be able to look through the CTracker logs to find the blocked functions.